X-Frame-Options
Indicates whether a browser should be allowed to render a page inside an <iframe>, <frame>, or <object>, protecting users against clickjacking attacks.
DENYProduction Server Implementation
add_header X-Frame-Options "DENY" always;Directives & Syntax Breakdown
Completely blocks the page from being displayed in an iframe on any site, including same origin.
Permits iframe rendering only if the parent frame belongs to the exact same origin (scheme, host, port).
Common Security Hazards & Pitfalls
- •The legacy "ALLOW-FROM uri" directive is obsolete and not supported in modern browsers. Use CSP "frame-ancestors" instead.
X-Frame-Options - Questions & Answers
Common implementation questions, browser enforcement rules, and debugging.
Clickjacking is an attack where a malicious site embeds your page in a transparent iframe and tricks authenticated users into clicking invisible buttons (like "Transfer Funds" or "Delete Account").
Related HTTP Headers
Browse All HeadersRestricts where scripts, images, styles, and frames can be loaded from, protecting websites from Cross-Site Scripting (XSS) and data injection attacks.
Forces modern web browsers to communicate exclusively over encrypted HTTPS connections, preventing SSL stripping and man-in-the-middle (MITM) attacks.
Prevents the browser from MIME-sniffing a response away from the declared Content-Type header, mitigating drive-by malware and MIME confusion attacks.
Controls how much referrer information (URL path and query parameters) is included when navigating away or loading external assets.
Allows site owners to selectively restrict browser hardware features, sensors, APIs, and privacy-invasive tracking mechanisms.
Specifies browser and CDN caching directives for requests and responses, dramatically accelerating load speeds or preventing cache leakage.